Skip to content

Fix/auto triage tunning#949

Merged
scottbrumley merged 8 commits into
mainfrom
fix/auto-triage-tunning
Jun 14, 2026
Merged

Fix/auto triage tunning#949
scottbrumley merged 8 commits into
mainfrom
fix/auto-triage-tunning

Conversation

@scottbrumley

Copy link
Copy Markdown
Contributor

No description provided.

…lose

The job timed out and couldn't drain large case backlogs: it paged the
incidents API by growing offset (slower each call) and closed one case per
update_incident call.

- replace offset pagination with a creation_time keyset cursor (offset stays
  0 every call), so fetch cost is flat and a 32k+ backlog no longer times out
- SOC Close Cases_V3 now posts incident_id_list (bulk) instead of a single
  incident_id; SOCAutoTriageScoreFilter emits pre-serialized close_batches of
  <=100 ids, turning ~32k single closes into ~320 bulk calls
- JOB - Auto Triage V3 feeds close_batches to the bulk close loop and sources
  score_threshold, window_hours, max_batches, batch_size from
  SOCOptimizationConfig_V3 (removes hard-coded max_batches "5")
- add TriageMaxBatches/TriageBatchSize to SOCOptimizationConfig_V3
- batch_size tunable, clamped to the 100 per-request ceiling; max_batches
  default 200; both fall back safely if a list key is missing

Deploy order: list -> script -> SOC Close Cases_V3 -> JOB.
… (dead output, harmless), and #8 still passes resolve_comment that the close playbook ignores (it hardcodes "Resolved by the Auto Triage Job"). Neither affects the run.

Run one job cycle and check that the cases actually flip to resolved this time — the 400 should be gone.
# Conflicts:
#	Packs/soc-optimization-unified/Playbooks/JOB_-_Auto_Triage_V3.yml
#	Packs/soc-optimization-unified/Scripts/SOCAutoTriageScoreFilter/SOCAutoTriageScoreFilter.py
@scottbrumley scottbrumley merged commit f21b8f8 into main Jun 14, 2026
14 checks passed
@scottbrumley scottbrumley deleted the fix/auto-triage-tunning branch June 14, 2026 21:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants